Cyber Resilience

CVE-2026-0977

MediumLPE

Published: 16 March 2026

Published
16 March 2026
Modified
02 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0001 1.7th percentile
Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-0977 is a medium-severity Improper Access Control (CWE-284) vulnerability in Ibm Cics Transaction Gateway. Its CVSS base score is 5.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 1.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-0977 affects IBM CICS Transaction Gateway for Multiplatforms versions 9.3 and 10.1 due to improper access controls (CWE-284). Published on 2026-03-16, the vulnerability enables a user to transfer or view files, earning a CVSS v3.1 base score of 5.1 (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

A local attacker requires no privileges (PR:N) and can exploit the issue with low attack complexity and no user interaction. Successful exploitation allows limited access to transfer or view files, yielding low confidentiality and integrity impacts but no availability disruption.

IBM provides details on the vulnerability, including mitigation guidance, in their security advisory at https://www.ibm.com/support/pages/node/7263518.

EU & UK References

Vulnerability details

IBM CICS Transaction Gateway for Multiplatforms 9.3 and 10.1 could allow a user to transfer or view files due to improper access controls.

CWE(s)
CWE-284NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

Improper access controls enable unauthorized local file viewing/transfer, directly facilitating data collection from the local system (T1005).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-28766Same vendor: Ibm
CVE-2025-13108Same vendor: Ibm
CVE-2026-2311Same vendor: Ibm
CVE-2025-1722Same vendor: Ibm
CVE-2026-28855Shared CWE-284
CVE-2024-31896Same vendor: Ibm
CVE-2026-28965Shared CWE-284
CVE-2026-28837Shared CWE-284
CVE-2026-1567Same vendor: Ibm
CVE-2024-40858Shared CWE-284

Affected Assets

ibm
cics transaction gateway
10.1, 9.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces approved authorizations for logical access to files, preventing the unauthorized transfer or viewing enabled by the improper access controls in CVE-2026-0977.

AC-6 Least Privilege good match
prevent

Requires assignment of the minimum necessary privileges, blocking the no-privilege local file access vector described in the CVE.

AC-4 Information Flow Enforcement partial match
prevent

Enforces information flow policies on file transfers, limiting the unauthorized movement of data that the vulnerability permits.

References